>From 8f4ccd35c2fdbe9841316f81427e156998916d68 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Wed, 11 Sep 2013 21:28:38 -0400 Subject: [PATCH 12/22] Updated sysctl templates - Old sysctl XCCDF names varied from "set_sysctl," "disable_sysctl" to "sysctl_*", standardized on "sysctl_*" - This change ensures that all XCCDF, OVAL, and bash scripts are properly linked together --- RHEL6/input/auxiliary/stig_overlay.xml | 2 +- RHEL6/input/auxiliary/transition_notes.xml | 24 +++++++------- .../fixes/bash/set_sysctl_fs_suid_dumpable.sh | 16 --------- .../fixes/bash/set_sysctl_kernel_dmesg_restrict.sh | 16 --------- .../fixes/bash/set_sysctl_kernel_exec_shield.sh | 16 --------- .../bash/set_sysctl_kernel_randomize_va_space.sh | 16 --------- ...et_sysctl_net_ipv4_conf_all_accept_redirects.sh | 16 --------- ...sysctl_net_ipv4_conf_all_accept_source_route.sh | 16 --------- .../set_sysctl_net_ipv4_conf_all_log_martians.sh | 16 --------- .../bash/set_sysctl_net_ipv4_conf_all_rp_filter.sh | 16 --------- ...et_sysctl_net_ipv4_conf_all_secure_redirects.sh | 16 --------- .../set_sysctl_net_ipv4_conf_all_send_redirects.sh | 16 --------- ...ysctl_net_ipv4_conf_default_accept_redirects.sh | 16 --------- ...tl_net_ipv4_conf_default_accept_source_route.sh | 16 --------- .../set_sysctl_net_ipv4_conf_default_rp_filter.sh | 16 --------- ...ysctl_net_ipv4_conf_default_secure_redirects.sh | 16 --------- ..._sysctl_net_ipv4_conf_default_send_redirects.sh | 16 --------- ..._sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh | 16 --------- ...l_net_ipv4_icmp_ignore_bogus_error_responses.sh | 16 --------- .../fixes/bash/set_sysctl_net_ipv4_ip_forward.sh | 16 --------- .../bash/set_sysctl_net_ipv4_tcp_syncookies.sh | 16 --------- .../set_sysctl_net_ipv6_conf_default_accept_ra.sh | 16 --------- ...ysctl_net_ipv6_conf_default_accept_redirects.sh | 16 --------- RHEL6/input/fixes/bash/sysctl_fs_suid_dumpable.sh | 16 +++++++++ .../fixes/bash/sysctl_kernel_dmesg_restrict.sh | 16 +++++++++ .../input/fixes/bash/sysctl_kernel_exec_shield.sh | 16 +++++++++ .../fixes/bash/sysctl_kernel_randomize_va_space.sh | 16 +++++++++ .../sysctl_net_ipv4_conf_all_accept_redirects.sh | 16 +++++++++ ...sysctl_net_ipv4_conf_all_accept_source_route.sh | 16 +++++++++ .../bash/sysctl_net_ipv4_conf_all_log_martians.sh | 16 +++++++++ .../bash/sysctl_net_ipv4_conf_all_rp_filter.sh | 16 +++++++++ .../sysctl_net_ipv4_conf_all_secure_redirects.sh | 16 +++++++++ .../sysctl_net_ipv4_conf_all_send_redirects.sh | 16 +++++++++ ...ysctl_net_ipv4_conf_default_accept_redirects.sh | 16 +++++++++ ...tl_net_ipv4_conf_default_accept_source_route.sh | 16 +++++++++ .../bash/sysctl_net_ipv4_conf_default_rp_filter.sh | 16 +++++++++ ...ysctl_net_ipv4_conf_default_secure_redirects.sh | 16 +++++++++ .../sysctl_net_ipv4_conf_default_send_redirects.sh | 16 +++++++++ .../sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh | 16 +++++++++ ...l_net_ipv4_icmp_ignore_bogus_error_responses.sh | 16 +++++++++ .../input/fixes/bash/sysctl_net_ipv4_ip_forward.sh | 16 +++++++++ .../fixes/bash/sysctl_net_ipv4_tcp_syncookies.sh | 16 +++++++++ .../bash/sysctl_net_ipv6_conf_default_accept_ra.sh | 16 +++++++++ ...ysctl_net_ipv6_conf_default_accept_redirects.sh | 16 +++++++++ .../fixes/bash/templates/create_sysctl_bash.py | 2 +- RHEL6/input/profiles/CS2.xml | 34 ++++++++++---------- RHEL6/input/profiles/common.xml | 32 +++++++++--------- RHEL6/input/profiles/fisma-medium-rhel6-server.xml | 32 +++++++++--------- RHEL6/input/profiles/nist-CL-IL-AL.xml | 32 +++++++++--------- RHEL6/input/profiles/usgcb-rhel6-server.xml | 34 ++++++++++---------- RHEL6/input/system/network/ipv6.xml | 4 +- RHEL6/input/system/network/kernel.xml | 30 +++++++++--------- 52 files changed, 449 insertions(+), 449 deletions(-) delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_fs_suid_dumpable.sh delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_kernel_dmesg_restrict.sh delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_kernel_exec_shield.sh delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_kernel_randomize_va_space.sh delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_redirects.sh delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_source_route.sh delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_log_martians.sh delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_rp_filter.sh delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_secure_redirects.sh delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_send_redirects.sh delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_redirects.sh delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_source_route.sh delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_rp_filter.sh delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_secure_redirects.sh delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_send_redirects.sh delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses.sh delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_ip_forward.sh delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv4_tcp_syncookies.sh delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_ra.sh delete mode 100644 RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_redirects.sh create mode 100644 RHEL6/input/fixes/bash/sysctl_fs_suid_dumpable.sh create mode 100644 RHEL6/input/fixes/bash/sysctl_kernel_dmesg_restrict.sh create mode 100644 RHEL6/input/fixes/bash/sysctl_kernel_exec_shield.sh create mode 100644 RHEL6/input/fixes/bash/sysctl_kernel_randomize_va_space.sh create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_accept_redirects.sh create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_accept_source_route.sh create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_log_martians.sh create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_rp_filter.sh create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_secure_redirects.sh create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_send_redirects.sh create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_accept_redirects.sh create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_accept_source_route.sh create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_rp_filter.sh create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_secure_redirects.sh create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_send_redirects.sh create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_icmp_ignore_bogus_error_responses.sh create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_ip_forward.sh create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv4_tcp_syncookies.sh create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv6_conf_default_accept_ra.sh create mode 100644 RHEL6/input/fixes/bash/sysctl_net_ipv6_conf_default_accept_redirects.sh diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml index 3dd40c8..3a71a58 100644 --- a/RHEL6/input/auxiliary/stig_overlay.xml +++ b/RHEL6/input/auxiliary/stig_overlay.xml @@ -222,7 +222,7 @@ The system must ignore ICMPv4 bogus error responses. - + The system must be configured to use TCP syncookies when experiencing a TCP SYN flood. diff --git a/RHEL6/input/auxiliary/transition_notes.xml b/RHEL6/input/auxiliary/transition_notes.xml index d809272..d4d4cba 100644 --- a/RHEL6/input/auxiliary/transition_notes.xml +++ b/RHEL6/input/auxiliary/transition_notes.xml @@ -1495,9 +1495,9 @@ rule=enable_execshield manual=no Check does exist in the RHEL6 prose, it can be automated and the OVAL for it does exist. -rule=set_sysctl_net_ipv4_conf_all_accept_source_route manual=no +rule=sysctl_net_ipv4_conf_all_accept_source_route manual=no This check is split in the RHEL6 prose and addressed in the rule listed above -and the set_sysctl_net_ipv4_conf_default_accept_source_route rule +and the sysctl_net_ipv4_conf_default_accept_source_route rule @@ -1510,7 +1510,7 @@ Per V-12010 don't allow FTP. Lets get rid of these other random FTP rules. Check does exist in the RHEL6 prose, it can be automated and the OVAL for it does exist. -rule=disable_sysctl_ipv4_ip_forward manual=no +rule=sysctl_ipv4_ip_forward manual=no @@ -1592,38 +1592,38 @@ This is accomplished by whitelisting specific types of icmp traffic. Check does exist in the RHEL6 prose, it can be automated and OVAL for it does exist. -rule=set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts manual=no +rule=sysctl_net_ipv4_icmp_echo_ignore_broadcasts manual=no V-22410 and V-22411 are the same. Check does exist in the RHEL6 prose, it can be automated and OVAL for it does exist. -rule=set_sysctl_net_ipv4_conf_all_accept_source_route manual=no +rule=sysctl_net_ipv4_conf_all_accept_source_route manual=no This check is split in the RHEL6 prose into the above and the -set_sysctl_net_ipv4_conf_default_accept_source_route rule. +sysctl_net_ipv4_conf_default_accept_source_route rule. Check does exist in the RHEL6 prose, it can be automated and OVAL for it does exist. -rule=set_sysctl_net_ipv4_conf_all_accept_redirects manual=no +rule=sysctl_net_ipv4_conf_all_accept_redirects manual=no This check is split in the RHEL6 prose into the above and the -set_sysctl_net_ipv4_conf_default_accept_redirects rule. +sysctl_net_ipv4_conf_default_accept_redirects rule. Check does exist in the RHEL6 prose, it can be automated and OVAL for it does exist. -rule=disable_sysctl_ipv4_all_send_redirects manual=no +rule=sysctl_ipv4_all_send_redirects manual=no This check is split in the RHEL6 prose into the above and the -disable_sysctl_ipv4_default_send_redirects rule. +sysctl_net_ipv4_conf_default_send_redirects rule. Partial check does exist in the RHEL6 prose, it can be automated and partial OVAL for it does exist. -rule=set_sysctl_net_ipv4_conf_all_log_martians manual=no +rule=sysctl_net_ipv4_conf_all_log_martians manual=no This check is split in the RHEL6 prose into the above but no equivalent rule exists for "default." @@ -1631,7 +1631,7 @@ exists for "default." Check does exist in the RHEL6 prose, it can be automated and OVAL for it does exist. -rule=set_sysctl_net_ipv4_tcp_syncookies manual=no +rule=sysctl_net_ipv4_tcp_syncookies manual=no diff --git a/RHEL6/input/fixes/bash/set_sysctl_fs_suid_dumpable.sh b/RHEL6/input/fixes/bash/set_sysctl_fs_suid_dumpable.sh deleted file mode 100644 index 640fff2..0000000 --- a/RHEL6/input/fixes/bash/set_sysctl_fs_suid_dumpable.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for fs.suid_dumpable -# -sysctl -q -n -w fs.suid_dumpable=0 - -# -# If fs.suid_dumpable present in /etc/sysctl.conf, change value to "0" -# else, add "fs.suid_dumpable = 0" to /etc/sysctl.conf -# -if grep --silent ^fs.suid_dumpable /etc/sysctl.conf ; then - sed -i 's/^fs.suid_dumpable.*/fs.suid_dumpable = 0/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set fs.suid_dumpable to 0 per security requirements" >> /etc/sysctl.conf - echo "fs.suid_dumpable = 0" >> /etc/sysctl.conf -fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_kernel_dmesg_restrict.sh b/RHEL6/input/fixes/bash/set_sysctl_kernel_dmesg_restrict.sh deleted file mode 100644 index 7420664..0000000 --- a/RHEL6/input/fixes/bash/set_sysctl_kernel_dmesg_restrict.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for kernel.dmesg_restrict -# -sysctl -q -n -w kernel.dmesg_restrict=1 - -# -# If kernel.dmesg_restrict present in /etc/sysctl.conf, change value to "1" -# else, add "kernel.dmesg_restrict = 1" to /etc/sysctl.conf -# -if grep --silent ^kernel.dmesg_restrict /etc/sysctl.conf ; then - sed -i 's/^kernel.dmesg_restrict.*/kernel.dmesg_restrict = 1/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set kernel.dmesg_restrict to 1 per security requirements" >> /etc/sysctl.conf - echo "kernel.dmesg_restrict = 1" >> /etc/sysctl.conf -fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_kernel_exec_shield.sh b/RHEL6/input/fixes/bash/set_sysctl_kernel_exec_shield.sh deleted file mode 100644 index 66142d7..0000000 --- a/RHEL6/input/fixes/bash/set_sysctl_kernel_exec_shield.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for kernel.exec-shield -# -sysctl -q -n -w kernel.exec-shield=1 - -# -# If kernel.exec-shield present in /etc/sysctl.conf, change value to "1" -# else, add "kernel.exec-shield = 1" to /etc/sysctl.conf -# -if grep --silent ^kernel.exec-shield /etc/sysctl.conf ; then - sed -i 's/^kernel.exec-shield.*/kernel.exec-shield = 1/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set kernel.exec-shield to 1 per security requirements" >> /etc/sysctl.conf - echo "kernel.exec-shield = 1" >> /etc/sysctl.conf -fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_kernel_randomize_va_space.sh b/RHEL6/input/fixes/bash/set_sysctl_kernel_randomize_va_space.sh deleted file mode 100644 index 9e600c0..0000000 --- a/RHEL6/input/fixes/bash/set_sysctl_kernel_randomize_va_space.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for kernel.randomize_va_space -# -sysctl -q -n -w kernel.randomize_va_space=2 - -# -# If kernel.randomize_va_space present in /etc/sysctl.conf, change value to "2" -# else, add "kernel.randomize_va_space = 2" to /etc/sysctl.conf -# -if grep --silent ^kernel.randomize_va_space /etc/sysctl.conf ; then - sed -i 's/^kernel.randomize_va_space.*/kernel.randomize_va_space = 2/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set kernel.randomize_va_space to 2 per security requirements" >> /etc/sysctl.conf - echo "kernel.randomize_va_space = 2" >> /etc/sysctl.conf -fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_redirects.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_redirects.sh deleted file mode 100644 index 2fad04e..0000000 --- a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_redirects.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for net.ipv4.conf.all.accept_redirects -# -sysctl -q -n -w net.ipv4.conf.all.accept_redirects=0 - -# -# If net.ipv4.conf.all.accept_redirects present in /etc/sysctl.conf, change value to "0" -# else, add "net.ipv4.conf.all.accept_redirects = 0" to /etc/sysctl.conf -# -if grep --silent ^net.ipv4.conf.all.accept_redirects /etc/sysctl.conf ; then - sed -i 's/^net.ipv4.conf.all.accept_redirects.*/net.ipv4.conf.all.accept_redirects = 0/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set net.ipv4.conf.all.accept_redirects to 0 per security requirements" >> /etc/sysctl.conf - echo "net.ipv4.conf.all.accept_redirects = 0" >> /etc/sysctl.conf -fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_source_route.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_source_route.sh deleted file mode 100644 index 54a9746..0000000 --- a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_accept_source_route.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for net.ipv4.conf.all.accept_source_route -# -sysctl -q -n -w net.ipv4.conf.all.accept_source_route=0 - -# -# If net.ipv4.conf.all.accept_source_route present in /etc/sysctl.conf, change value to "0" -# else, add "net.ipv4.conf.all.accept_source_route = 0" to /etc/sysctl.conf -# -if grep --silent ^net.ipv4.conf.all.accept_source_route /etc/sysctl.conf ; then - sed -i 's/^net.ipv4.conf.all.accept_source_route.*/net.ipv4.conf.all.accept_source_route = 0/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set net.ipv4.conf.all.accept_source_route to 0 per security requirements" >> /etc/sysctl.conf - echo "net.ipv4.conf.all.accept_source_route = 0" >> /etc/sysctl.conf -fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_log_martians.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_log_martians.sh deleted file mode 100644 index 9388226..0000000 --- a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_log_martians.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for net.ipv4.conf.all.log_martians -# -sysctl -q -n -w net.ipv4.conf.all.log_martians=1 - -# -# If net.ipv4.conf.all.log_martians present in /etc/sysctl.conf, change value to "1" -# else, add "net.ipv4.conf.all.log_martians = 1" to /etc/sysctl.conf -# -if grep --silent ^net.ipv4.conf.all.log_martians /etc/sysctl.conf ; then - sed -i 's/^net.ipv4.conf.all.log_martians.*/net.ipv4.conf.all.log_martians = 1/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set net.ipv4.conf.all.log_martians to 1 per security requirements" >> /etc/sysctl.conf - echo "net.ipv4.conf.all.log_martians = 1" >> /etc/sysctl.conf -fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_rp_filter.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_rp_filter.sh deleted file mode 100644 index 81eb072..0000000 --- a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_rp_filter.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for net.ipv4.conf.all.rp_filter -# -sysctl -q -n -w net.ipv4.conf.all.rp_filter=1 - -# -# If net.ipv4.conf.all.rp_filter present in /etc/sysctl.conf, change value to "1" -# else, add "net.ipv4.conf.all.rp_filter = 1" to /etc/sysctl.conf -# -if grep --silent ^net.ipv4.conf.all.rp_filter /etc/sysctl.conf ; then - sed -i 's/^net.ipv4.conf.all.rp_filter.*/net.ipv4.conf.all.rp_filter = 1/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set net.ipv4.conf.all.rp_filter to 1 per security requirements" >> /etc/sysctl.conf - echo "net.ipv4.conf.all.rp_filter = 1" >> /etc/sysctl.conf -fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_secure_redirects.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_secure_redirects.sh deleted file mode 100644 index 002d19f..0000000 --- a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_secure_redirects.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for net.ipv4.conf.all.secure_redirects -# -sysctl -q -n -w net.ipv4.conf.all.secure_redirects=0 - -# -# If net.ipv4.conf.all.secure_redirects present in /etc/sysctl.conf, change value to "0" -# else, add "net.ipv4.conf.all.secure_redirects = 0" to /etc/sysctl.conf -# -if grep --silent ^net.ipv4.conf.all.secure_redirects /etc/sysctl.conf ; then - sed -i 's/^net.ipv4.conf.all.secure_redirects.*/net.ipv4.conf.all.secure_redirects = 0/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set net.ipv4.conf.all.secure_redirects to 0 per security requirements" >> /etc/sysctl.conf - echo "net.ipv4.conf.all.secure_redirects = 0" >> /etc/sysctl.conf -fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_send_redirects.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_send_redirects.sh deleted file mode 100644 index 842dbcb..0000000 --- a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_all_send_redirects.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for net.ipv4.conf.all.send_redirects -# -sysctl -q -n -w net.ipv4.conf.all.send_redirects=0 - -# -# If net.ipv4.conf.all.send_redirects present in /etc/sysctl.conf, change value to "0" -# else, add "net.ipv4.conf.all.send_redirects = 0" to /etc/sysctl.conf -# -if grep --silent ^net.ipv4.conf.all.send_redirects /etc/sysctl.conf ; then - sed -i 's/^net.ipv4.conf.all.send_redirects.*/net.ipv4.conf.all.send_redirects = 0/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set net.ipv4.conf.all.send_redirects to 0 per security requirements" >> /etc/sysctl.conf - echo "net.ipv4.conf.all.send_redirects = 0" >> /etc/sysctl.conf -fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_redirects.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_redirects.sh deleted file mode 100644 index a1403b5..0000000 --- a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_redirects.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for net.ipv4.conf.default.accept_redirects -# -sysctl -q -n -w net.ipv4.conf.default.accept_redirects=0 - -# -# If net.ipv4.conf.default.accept_redirects present in /etc/sysctl.conf, change value to "0" -# else, add "net.ipv4.conf.default.accept_redirects = 0" to /etc/sysctl.conf -# -if grep --silent ^net.ipv4.conf.default.accept_redirects /etc/sysctl.conf ; then - sed -i 's/^net.ipv4.conf.default.accept_redirects.*/net.ipv4.conf.default.accept_redirects = 0/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set net.ipv4.conf.default.accept_redirects to 0 per security requirements" >> /etc/sysctl.conf - echo "net.ipv4.conf.default.accept_redirects = 0" >> /etc/sysctl.conf -fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_source_route.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_source_route.sh deleted file mode 100644 index 0bb5b0f..0000000 --- a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_accept_source_route.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for net.ipv4.conf.default.accept_source_route -# -sysctl -q -n -w net.ipv4.conf.default.accept_source_route=0 - -# -# If net.ipv4.conf.default.accept_source_route present in /etc/sysctl.conf, change value to "0" -# else, add "net.ipv4.conf.default.accept_source_route = 0" to /etc/sysctl.conf -# -if grep --silent ^net.ipv4.conf.default.accept_source_route /etc/sysctl.conf ; then - sed -i 's/^net.ipv4.conf.default.accept_source_route.*/net.ipv4.conf.default.accept_source_route = 0/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set net.ipv4.conf.default.accept_source_route to 0 per security requirements" >> /etc/sysctl.conf - echo "net.ipv4.conf.default.accept_source_route = 0" >> /etc/sysctl.conf -fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_rp_filter.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_rp_filter.sh deleted file mode 100644 index 89795c4..0000000 --- a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_rp_filter.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for net.ipv4.conf.default.rp_filter -# -sysctl -q -n -w net.ipv4.conf.default.rp_filter=1 - -# -# If net.ipv4.conf.default.rp_filter present in /etc/sysctl.conf, change value to "1" -# else, add "net.ipv4.conf.default.rp_filter = 1" to /etc/sysctl.conf -# -if grep --silent ^net.ipv4.conf.default.rp_filter /etc/sysctl.conf ; then - sed -i 's/^net.ipv4.conf.default.rp_filter.*/net.ipv4.conf.default.rp_filter = 1/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set net.ipv4.conf.default.rp_filter to 1 per security requirements" >> /etc/sysctl.conf - echo "net.ipv4.conf.default.rp_filter = 1" >> /etc/sysctl.conf -fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_secure_redirects.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_secure_redirects.sh deleted file mode 100644 index 2230dc5..0000000 --- a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_secure_redirects.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for net.ipv4.conf.default.secure_redirects -# -sysctl -q -n -w net.ipv4.conf.default.secure_redirects=0 - -# -# If net.ipv4.conf.default.secure_redirects present in /etc/sysctl.conf, change value to "0" -# else, add "net.ipv4.conf.default.secure_redirects = 0" to /etc/sysctl.conf -# -if grep --silent ^net.ipv4.conf.default.secure_redirects /etc/sysctl.conf ; then - sed -i 's/^net.ipv4.conf.default.secure_redirects.*/net.ipv4.conf.default.secure_redirects = 0/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set net.ipv4.conf.default.secure_redirects to 0 per security requirements" >> /etc/sysctl.conf - echo "net.ipv4.conf.default.secure_redirects = 0" >> /etc/sysctl.conf -fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_send_redirects.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_send_redirects.sh deleted file mode 100644 index 6009c0d..0000000 --- a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_conf_default_send_redirects.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for net.ipv4.conf.default.send_redirects -# -sysctl -q -n -w net.ipv4.conf.default.send_redirects=0 - -# -# If net.ipv4.conf.default.send_redirects present in /etc/sysctl.conf, change value to "0" -# else, add "net.ipv4.conf.default.send_redirects = 0" to /etc/sysctl.conf -# -if grep --silent ^net.ipv4.conf.default.send_redirects /etc/sysctl.conf ; then - sed -i 's/^net.ipv4.conf.default.send_redirects.*/net.ipv4.conf.default.send_redirects = 0/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set net.ipv4.conf.default.send_redirects to 0 per security requirements" >> /etc/sysctl.conf - echo "net.ipv4.conf.default.send_redirects = 0" >> /etc/sysctl.conf -fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh deleted file mode 100644 index 2d737fa..0000000 --- a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for net.ipv4.icmp_echo_ignore_broadcasts -# -sysctl -q -n -w net.ipv4.icmp_echo_ignore_broadcasts=1 - -# -# If net.ipv4.icmp_echo_ignore_broadcasts present in /etc/sysctl.conf, change value to "1" -# else, add "net.ipv4.icmp_echo_ignore_broadcasts = 1" to /etc/sysctl.conf -# -if grep --silent ^net.ipv4.icmp_echo_ignore_broadcasts /etc/sysctl.conf ; then - sed -i 's/^net.ipv4.icmp_echo_ignore_broadcasts.*/net.ipv4.icmp_echo_ignore_broadcasts = 1/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set net.ipv4.icmp_echo_ignore_broadcasts to 1 per security requirements" >> /etc/sysctl.conf - echo "net.ipv4.icmp_echo_ignore_broadcasts = 1" >> /etc/sysctl.conf -fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses.sh deleted file mode 100644 index 6cb96fa..0000000 --- a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for net.ipv4.icmp_ignore_bogus_error_responses -# -sysctl -q -n -w net.ipv4.icmp_ignore_bogus_error_responses=1 - -# -# If net.ipv4.icmp_ignore_bogus_error_responses present in /etc/sysctl.conf, change value to "1" -# else, add "net.ipv4.icmp_ignore_bogus_error_responses = 1" to /etc/sysctl.conf -# -if grep --silent ^net.ipv4.icmp_ignore_bogus_error_responses /etc/sysctl.conf ; then - sed -i 's/^net.ipv4.icmp_ignore_bogus_error_responses.*/net.ipv4.icmp_ignore_bogus_error_responses = 1/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set net.ipv4.icmp_ignore_bogus_error_responses to 1 per security requirements" >> /etc/sysctl.conf - echo "net.ipv4.icmp_ignore_bogus_error_responses = 1" >> /etc/sysctl.conf -fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_ip_forward.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_ip_forward.sh deleted file mode 100644 index 3292a63..0000000 --- a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_ip_forward.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for net.ipv4.ip_forward -# -sysctl -q -n -w net.ipv4.ip_forward=0 - -# -# If net.ipv4.ip_forward present in /etc/sysctl.conf, change value to "0" -# else, add "net.ipv4.ip_forward = 0" to /etc/sysctl.conf -# -if grep --silent ^net.ipv4.ip_forward /etc/sysctl.conf ; then - sed -i 's/^net.ipv4.ip_forward.*/net.ipv4.ip_forward = 0/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set net.ipv4.ip_forward to 0 per security requirements" >> /etc/sysctl.conf - echo "net.ipv4.ip_forward = 0" >> /etc/sysctl.conf -fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_tcp_syncookies.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_tcp_syncookies.sh deleted file mode 100644 index 456870c..0000000 --- a/RHEL6/input/fixes/bash/set_sysctl_net_ipv4_tcp_syncookies.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for net.ipv4.tcp_syncookies -# -sysctl -q -n -w net.ipv4.tcp_syncookies=1 - -# -# If net.ipv4.tcp_syncookies present in /etc/sysctl.conf, change value to "1" -# else, add "net.ipv4.tcp_syncookies = 1" to /etc/sysctl.conf -# -if grep --silent ^net.ipv4.tcp_syncookies /etc/sysctl.conf ; then - sed -i 's/^net.ipv4.tcp_syncookies.*/net.ipv4.tcp_syncookies = 1/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set net.ipv4.tcp_syncookies to 1 per security requirements" >> /etc/sysctl.conf - echo "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.conf -fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_ra.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_ra.sh deleted file mode 100644 index be879c2..0000000 --- a/RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_ra.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for net.ipv6.conf.default.accept_ra -# -sysctl -q -n -w net.ipv6.conf.default.accept_ra=0 - -# -# If net.ipv6.conf.default.accept_ra present in /etc/sysctl.conf, change value to "0" -# else, add "net.ipv6.conf.default.accept_ra = 0" to /etc/sysctl.conf -# -if grep --silent ^net.ipv6.conf.default.accept_ra /etc/sysctl.conf ; then - sed -i 's/^net.ipv6.conf.default.accept_ra.*/net.ipv6.conf.default.accept_ra = 0/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set net.ipv6.conf.default.accept_ra to 0 per security requirements" >> /etc/sysctl.conf - echo "net.ipv6.conf.default.accept_ra = 0" >> /etc/sysctl.conf -fi diff --git a/RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_redirects.sh b/RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_redirects.sh deleted file mode 100644 index 5dadfbe..0000000 --- a/RHEL6/input/fixes/bash/set_sysctl_net_ipv6_conf_default_accept_redirects.sh +++ /dev/null @@ -1,16 +0,0 @@ -# -# Set runtime for net.ipv6.conf.default.accept_redirects -# -sysctl -q -n -w net.ipv6.conf.default.accept_redirects=0 - -# -# If net.ipv6.conf.default.accept_redirects present in /etc/sysctl.conf, change value to "0" -# else, add "net.ipv6.conf.default.accept_redirects = 0" to /etc/sysctl.conf -# -if grep --silent ^net.ipv6.conf.default.accept_redirects /etc/sysctl.conf ; then - sed -i 's/^net.ipv6.conf.default.accept_redirects.*/net.ipv6.conf.default.accept_redirects = 0/g' /etc/sysctl.conf -else - echo "" >> /etc/sysctl.conf - echo "# Set net.ipv6.conf.default.accept_redirects to 0 per security requirements" >> /etc/sysctl.conf - echo "net.ipv6.conf.default.accept_redirects = 0" >> /etc/sysctl.conf -fi diff --git a/RHEL6/input/fixes/bash/sysctl_fs_suid_dumpable.sh b/RHEL6/input/fixes/bash/sysctl_fs_suid_dumpable.sh new file mode 100644 index 0000000..640fff2 --- /dev/null +++ b/RHEL6/input/fixes/bash/sysctl_fs_suid_dumpable.sh @@ -0,0 +1,16 @@ +# +# Set runtime for fs.suid_dumpable +# +sysctl -q -n -w fs.suid_dumpable=0 + +# +# If fs.suid_dumpable present in /etc/sysctl.conf, change value to "0" +# else, add "fs.suid_dumpable = 0" to /etc/sysctl.conf +# +if grep --silent ^fs.suid_dumpable /etc/sysctl.conf ; then + sed -i 's/^fs.suid_dumpable.*/fs.suid_dumpable = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set fs.suid_dumpable to 0 per security requirements" >> /etc/sysctl.conf + echo "fs.suid_dumpable = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/sysctl_kernel_dmesg_restrict.sh b/RHEL6/input/fixes/bash/sysctl_kernel_dmesg_restrict.sh new file mode 100644 index 0000000..7420664 --- /dev/null +++ b/RHEL6/input/fixes/bash/sysctl_kernel_dmesg_restrict.sh @@ -0,0 +1,16 @@ +# +# Set runtime for kernel.dmesg_restrict +# +sysctl -q -n -w kernel.dmesg_restrict=1 + +# +# If kernel.dmesg_restrict present in /etc/sysctl.conf, change value to "1" +# else, add "kernel.dmesg_restrict = 1" to /etc/sysctl.conf +# +if grep --silent ^kernel.dmesg_restrict /etc/sysctl.conf ; then + sed -i 's/^kernel.dmesg_restrict.*/kernel.dmesg_restrict = 1/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set kernel.dmesg_restrict to 1 per security requirements" >> /etc/sysctl.conf + echo "kernel.dmesg_restrict = 1" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/sysctl_kernel_exec_shield.sh b/RHEL6/input/fixes/bash/sysctl_kernel_exec_shield.sh new file mode 100644 index 0000000..66142d7 --- /dev/null +++ b/RHEL6/input/fixes/bash/sysctl_kernel_exec_shield.sh @@ -0,0 +1,16 @@ +# +# Set runtime for kernel.exec-shield +# +sysctl -q -n -w kernel.exec-shield=1 + +# +# If kernel.exec-shield present in /etc/sysctl.conf, change value to "1" +# else, add "kernel.exec-shield = 1" to /etc/sysctl.conf +# +if grep --silent ^kernel.exec-shield /etc/sysctl.conf ; then + sed -i 's/^kernel.exec-shield.*/kernel.exec-shield = 1/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set kernel.exec-shield to 1 per security requirements" >> /etc/sysctl.conf + echo "kernel.exec-shield = 1" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/sysctl_kernel_randomize_va_space.sh b/RHEL6/input/fixes/bash/sysctl_kernel_randomize_va_space.sh new file mode 100644 index 0000000..9e600c0 --- /dev/null +++ b/RHEL6/input/fixes/bash/sysctl_kernel_randomize_va_space.sh @@ -0,0 +1,16 @@ +# +# Set runtime for kernel.randomize_va_space +# +sysctl -q -n -w kernel.randomize_va_space=2 + +# +# If kernel.randomize_va_space present in /etc/sysctl.conf, change value to "2" +# else, add "kernel.randomize_va_space = 2" to /etc/sysctl.conf +# +if grep --silent ^kernel.randomize_va_space /etc/sysctl.conf ; then + sed -i 's/^kernel.randomize_va_space.*/kernel.randomize_va_space = 2/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set kernel.randomize_va_space to 2 per security requirements" >> /etc/sysctl.conf + echo "kernel.randomize_va_space = 2" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_accept_redirects.sh b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_accept_redirects.sh new file mode 100644 index 0000000..2fad04e --- /dev/null +++ b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_accept_redirects.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.all.accept_redirects +# +sysctl -q -n -w net.ipv4.conf.all.accept_redirects=0 + +# +# If net.ipv4.conf.all.accept_redirects present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv4.conf.all.accept_redirects = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.all.accept_redirects /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.all.accept_redirects.*/net.ipv4.conf.all.accept_redirects = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.all.accept_redirects to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.all.accept_redirects = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_accept_source_route.sh b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_accept_source_route.sh new file mode 100644 index 0000000..54a9746 --- /dev/null +++ b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_accept_source_route.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.all.accept_source_route +# +sysctl -q -n -w net.ipv4.conf.all.accept_source_route=0 + +# +# If net.ipv4.conf.all.accept_source_route present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv4.conf.all.accept_source_route = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.all.accept_source_route /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.all.accept_source_route.*/net.ipv4.conf.all.accept_source_route = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.all.accept_source_route to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.all.accept_source_route = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_log_martians.sh b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_log_martians.sh new file mode 100644 index 0000000..9388226 --- /dev/null +++ b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_log_martians.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.all.log_martians +# +sysctl -q -n -w net.ipv4.conf.all.log_martians=1 + +# +# If net.ipv4.conf.all.log_martians present in /etc/sysctl.conf, change value to "1" +# else, add "net.ipv4.conf.all.log_martians = 1" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.all.log_martians /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.all.log_martians.*/net.ipv4.conf.all.log_martians = 1/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.all.log_martians to 1 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.all.log_martians = 1" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_rp_filter.sh b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_rp_filter.sh new file mode 100644 index 0000000..81eb072 --- /dev/null +++ b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_rp_filter.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.all.rp_filter +# +sysctl -q -n -w net.ipv4.conf.all.rp_filter=1 + +# +# If net.ipv4.conf.all.rp_filter present in /etc/sysctl.conf, change value to "1" +# else, add "net.ipv4.conf.all.rp_filter = 1" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.all.rp_filter /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.all.rp_filter.*/net.ipv4.conf.all.rp_filter = 1/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.all.rp_filter to 1 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.all.rp_filter = 1" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_secure_redirects.sh b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_secure_redirects.sh new file mode 100644 index 0000000..002d19f --- /dev/null +++ b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_secure_redirects.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.all.secure_redirects +# +sysctl -q -n -w net.ipv4.conf.all.secure_redirects=0 + +# +# If net.ipv4.conf.all.secure_redirects present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv4.conf.all.secure_redirects = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.all.secure_redirects /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.all.secure_redirects.*/net.ipv4.conf.all.secure_redirects = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.all.secure_redirects to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.all.secure_redirects = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_send_redirects.sh b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_send_redirects.sh new file mode 100644 index 0000000..842dbcb --- /dev/null +++ b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_all_send_redirects.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.all.send_redirects +# +sysctl -q -n -w net.ipv4.conf.all.send_redirects=0 + +# +# If net.ipv4.conf.all.send_redirects present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv4.conf.all.send_redirects = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.all.send_redirects /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.all.send_redirects.*/net.ipv4.conf.all.send_redirects = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.all.send_redirects to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.all.send_redirects = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_accept_redirects.sh b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_accept_redirects.sh new file mode 100644 index 0000000..a1403b5 --- /dev/null +++ b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_accept_redirects.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.default.accept_redirects +# +sysctl -q -n -w net.ipv4.conf.default.accept_redirects=0 + +# +# If net.ipv4.conf.default.accept_redirects present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv4.conf.default.accept_redirects = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.default.accept_redirects /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.default.accept_redirects.*/net.ipv4.conf.default.accept_redirects = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.default.accept_redirects to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.default.accept_redirects = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_accept_source_route.sh b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_accept_source_route.sh new file mode 100644 index 0000000..0bb5b0f --- /dev/null +++ b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_accept_source_route.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.default.accept_source_route +# +sysctl -q -n -w net.ipv4.conf.default.accept_source_route=0 + +# +# If net.ipv4.conf.default.accept_source_route present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv4.conf.default.accept_source_route = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.default.accept_source_route /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.default.accept_source_route.*/net.ipv4.conf.default.accept_source_route = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.default.accept_source_route to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.default.accept_source_route = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_rp_filter.sh b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_rp_filter.sh new file mode 100644 index 0000000..89795c4 --- /dev/null +++ b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_rp_filter.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.default.rp_filter +# +sysctl -q -n -w net.ipv4.conf.default.rp_filter=1 + +# +# If net.ipv4.conf.default.rp_filter present in /etc/sysctl.conf, change value to "1" +# else, add "net.ipv4.conf.default.rp_filter = 1" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.default.rp_filter /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.default.rp_filter.*/net.ipv4.conf.default.rp_filter = 1/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.default.rp_filter to 1 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.default.rp_filter = 1" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_secure_redirects.sh b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_secure_redirects.sh new file mode 100644 index 0000000..2230dc5 --- /dev/null +++ b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_secure_redirects.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.default.secure_redirects +# +sysctl -q -n -w net.ipv4.conf.default.secure_redirects=0 + +# +# If net.ipv4.conf.default.secure_redirects present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv4.conf.default.secure_redirects = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.default.secure_redirects /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.default.secure_redirects.*/net.ipv4.conf.default.secure_redirects = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.default.secure_redirects to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.default.secure_redirects = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_send_redirects.sh b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_send_redirects.sh new file mode 100644 index 0000000..6009c0d --- /dev/null +++ b/RHEL6/input/fixes/bash/sysctl_net_ipv4_conf_default_send_redirects.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.conf.default.send_redirects +# +sysctl -q -n -w net.ipv4.conf.default.send_redirects=0 + +# +# If net.ipv4.conf.default.send_redirects present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv4.conf.default.send_redirects = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.conf.default.send_redirects /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.conf.default.send_redirects.*/net.ipv4.conf.default.send_redirects = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.conf.default.send_redirects to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.conf.default.send_redirects = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh b/RHEL6/input/fixes/bash/sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh new file mode 100644 index 0000000..2d737fa --- /dev/null +++ b/RHEL6/input/fixes/bash/sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.icmp_echo_ignore_broadcasts +# +sysctl -q -n -w net.ipv4.icmp_echo_ignore_broadcasts=1 + +# +# If net.ipv4.icmp_echo_ignore_broadcasts present in /etc/sysctl.conf, change value to "1" +# else, add "net.ipv4.icmp_echo_ignore_broadcasts = 1" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.icmp_echo_ignore_broadcasts /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.icmp_echo_ignore_broadcasts.*/net.ipv4.icmp_echo_ignore_broadcasts = 1/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.icmp_echo_ignore_broadcasts to 1 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.icmp_echo_ignore_broadcasts = 1" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/sysctl_net_ipv4_icmp_ignore_bogus_error_responses.sh b/RHEL6/input/fixes/bash/sysctl_net_ipv4_icmp_ignore_bogus_error_responses.sh new file mode 100644 index 0000000..6cb96fa --- /dev/null +++ b/RHEL6/input/fixes/bash/sysctl_net_ipv4_icmp_ignore_bogus_error_responses.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.icmp_ignore_bogus_error_responses +# +sysctl -q -n -w net.ipv4.icmp_ignore_bogus_error_responses=1 + +# +# If net.ipv4.icmp_ignore_bogus_error_responses present in /etc/sysctl.conf, change value to "1" +# else, add "net.ipv4.icmp_ignore_bogus_error_responses = 1" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.icmp_ignore_bogus_error_responses /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.icmp_ignore_bogus_error_responses.*/net.ipv4.icmp_ignore_bogus_error_responses = 1/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.icmp_ignore_bogus_error_responses to 1 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.icmp_ignore_bogus_error_responses = 1" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/sysctl_net_ipv4_ip_forward.sh b/RHEL6/input/fixes/bash/sysctl_net_ipv4_ip_forward.sh new file mode 100644 index 0000000..3292a63 --- /dev/null +++ b/RHEL6/input/fixes/bash/sysctl_net_ipv4_ip_forward.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.ip_forward +# +sysctl -q -n -w net.ipv4.ip_forward=0 + +# +# If net.ipv4.ip_forward present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv4.ip_forward = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.ip_forward /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.ip_forward.*/net.ipv4.ip_forward = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.ip_forward to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.ip_forward = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/sysctl_net_ipv4_tcp_syncookies.sh b/RHEL6/input/fixes/bash/sysctl_net_ipv4_tcp_syncookies.sh new file mode 100644 index 0000000..456870c --- /dev/null +++ b/RHEL6/input/fixes/bash/sysctl_net_ipv4_tcp_syncookies.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv4.tcp_syncookies +# +sysctl -q -n -w net.ipv4.tcp_syncookies=1 + +# +# If net.ipv4.tcp_syncookies present in /etc/sysctl.conf, change value to "1" +# else, add "net.ipv4.tcp_syncookies = 1" to /etc/sysctl.conf +# +if grep --silent ^net.ipv4.tcp_syncookies /etc/sysctl.conf ; then + sed -i 's/^net.ipv4.tcp_syncookies.*/net.ipv4.tcp_syncookies = 1/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv4.tcp_syncookies to 1 per security requirements" >> /etc/sysctl.conf + echo "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/sysctl_net_ipv6_conf_default_accept_ra.sh b/RHEL6/input/fixes/bash/sysctl_net_ipv6_conf_default_accept_ra.sh new file mode 100644 index 0000000..be879c2 --- /dev/null +++ b/RHEL6/input/fixes/bash/sysctl_net_ipv6_conf_default_accept_ra.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv6.conf.default.accept_ra +# +sysctl -q -n -w net.ipv6.conf.default.accept_ra=0 + +# +# If net.ipv6.conf.default.accept_ra present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv6.conf.default.accept_ra = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv6.conf.default.accept_ra /etc/sysctl.conf ; then + sed -i 's/^net.ipv6.conf.default.accept_ra.*/net.ipv6.conf.default.accept_ra = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv6.conf.default.accept_ra to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv6.conf.default.accept_ra = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/sysctl_net_ipv6_conf_default_accept_redirects.sh b/RHEL6/input/fixes/bash/sysctl_net_ipv6_conf_default_accept_redirects.sh new file mode 100644 index 0000000..5dadfbe --- /dev/null +++ b/RHEL6/input/fixes/bash/sysctl_net_ipv6_conf_default_accept_redirects.sh @@ -0,0 +1,16 @@ +# +# Set runtime for net.ipv6.conf.default.accept_redirects +# +sysctl -q -n -w net.ipv6.conf.default.accept_redirects=0 + +# +# If net.ipv6.conf.default.accept_redirects present in /etc/sysctl.conf, change value to "0" +# else, add "net.ipv6.conf.default.accept_redirects = 0" to /etc/sysctl.conf +# +if grep --silent ^net.ipv6.conf.default.accept_redirects /etc/sysctl.conf ; then + sed -i 's/^net.ipv6.conf.default.accept_redirects.*/net.ipv6.conf.default.accept_redirects = 0/g' /etc/sysctl.conf +else + echo "" >> /etc/sysctl.conf + echo "# Set net.ipv6.conf.default.accept_redirects to 0 per security requirements" >> /etc/sysctl.conf + echo "net.ipv6.conf.default.accept_redirects = 0" >> /etc/sysctl.conf +fi diff --git a/RHEL6/input/fixes/bash/templates/create_sysctl_bash.py b/RHEL6/input/fixes/bash/templates/create_sysctl_bash.py index 6eae9ae..4d42ed3 100755 --- a/RHEL6/input/fixes/bash/templates/create_sysctl_bash.py +++ b/RHEL6/input/fixes/bash/templates/create_sysctl_bash.py @@ -14,7 +14,7 @@ def output_checkfile(serviceinfo): filestring = filestring.replace("SYSCTLVAR", sysctl_var) filestring = filestring.replace("SYSCTLVAL", sysctl_val) # write the check - with open("./output/set_sysctl_" + sysctl_var_id + ".sh", 'wb+') as outputfile: + with open("./output/sysctl_" + sysctl_var_id + ".sh", 'wb+') as outputfile: outputfile.write(filestring) outputfile.close() diff --git a/RHEL6/input/profiles/CS2.xml b/RHEL6/input/profiles/CS2.xml index 5d6e5dd..38b8c77 100644 --- a/RHEL6/input/profiles/CS2.xml +++ b/RHEL6/input/profiles/CS2.xml @@ -194,21 +194,21 @@ - - - - - - - - + + + + + + + @@ -217,8 +217,8 @@ - + - - - - - - - + + + + + + + + - - - - - + + + + @@ -137,7 +137,7 @@ - diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml index f16cc68..5ab5bb6 100644 --- a/RHEL6/input/profiles/nist-CL-IL-AL.xml +++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml @@ -117,13 +117,13 @@ assurance." - - - + + + + - - + @@ -312,12 +312,12 @@ assurance." - - - + + + diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml index 2ffad57..e4deed8 100644 --- a/RHEL6/input/profiles/usgcb-rhel6-server.xml +++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml @@ -117,41 +117,41 @@ - + + + + + + + + + + + + + + - +